Re: Comments on PHP security
| From: | Robert Cummings | Date: | Fri, 12 Jan 2007 16:40:32 +0000 |
| Subject: | Re: Comments on PHP security | ||
| References: | 1 2 3 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-27402@lists.php.net to get a copy of this message | ||
On Fri, 2007-01-12 at 15:57 +0000, Tim Starling wrote:
>
> Limits, table names, and several other query parts are protected by
> MediaWiki's query builder. A complex select query might look like this:
>
> $result = $db->select(
> # Tables
> array( 'user', 'revision' ),
> # Fields
> array( 'user_name', 'rev_timestamp' ),
> # Conditions (WHERE)
> array(
> 'user_id=rev_user',
> 'rev_page' => $page_id
> ),
> # Query tag, goes into a comment in the SQL
> __METHOD__,
> # Options
> array(
> 'LIMIT' => 10,
> 'ORDER BY' => 'rev_timestamp DESC',
> )
> );
>
> It even has some degree of DBMS-independence, thanks to creative
> interpretation of the options parameter. This is what I would like to see
> in the PHP core.
Wow, that's hideous!
Cheers,
Rob.
--
.------------------------------------------------------------.
| InterJinn Application Framework - http://www.interjinn.com
|
:------------------------------------------------------------:
| An application and templating framework for PHP. Boasting |
| a powerful, scalable system for accessing system services |
| such as forms, properties, sessions, and caches. InterJinn |
| also provides an extremely flexible architecture for |
| creating re-usable components quickly and easily. |
`------------------------------------------------------------'